63,500 Patients Impacted by Middletown Medical Data Breach
A misconfigured security setting on a radiology interface has resulted in the exposure of tens of thousands of patients’ protected health information.
Middletown Medical, a multi-specialty physicians’ group based in Middleton, NY, discovered the misconfigured security setting on January 29, 2018.
The following day the interface was secured to ensure unauthorized individuals were prevented from accessing patient information. It is unclear for how long patient data was accessible. Middletown Medical says only a limited number of patients’ PHI could have been accessed by unauthorized individuals.
Highly sensitive information such as financial data, Social Security numbers, and insurance information were not exposed. The breach was limited to names, client identification numbers, birth dates, confirmation that radiology services had been received by patients, and the dates those services were provided. A limited number of patients also had diagnosis codes, radiology images, and radiology reports exposed.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The discovery of the error prompted Middletown Medical to review its polices and procedures and implement additional safeguards to ensure the confidentiality of documents containing PHI. Additional training has been provided to staff on securing information systems and modifications have been made to interfaces to ensure all information remains secure.
No reports of misuse of PHI have been received although, out of an abundance of caution, all patients impacted by the breach have been offered complimentary identity theft recovery services for 12 months and have been advised to carefully review their account statements and Explanation of Benefits statements for any sign or fraudulent activity.
The data breach summary submitted to the Department of Health and Human Services’ Office for Civil Rights indicates up to 63,551 patients had their PHI exposed, making this one of the largest healthcare security incidents to be reported so far this year.
